I am trying to create a table something like this that will fetch the data for all the events for the past 7 days. I want this to be ran any time and it would update the dates dynamically at the top. I want it to look something like this:
Host | Sourcetype | 6/1 | 6/2 | 6/3 | 6/4 | 6/5 | 6/6 | 6/7 |
" " | " " | Count | Count | Count | Count | Count | Count | count |
Here is my search so far:
index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d") | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | rename count as "Number of events"
The dates show vertically and I wanted it to show up as column headers for the last 7 days that updates dynamically whenever I run this search.
index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d") | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | eval hosts=host."::".sourcetype | xyseries hosts dayOfDate count
index=" " | bucket span=1d _time | eval dayOfDate=strftime(_time,"%Y/%m/%d") | stats count by host, sourcetype, dayOfDate | table host sourcetype dayOfDate count | eval hosts=host."::".sourcetype | xyseries hosts dayOfDate count
Thanks for that @to4kawa !!
But is it possible to have two different columns for hosts and sourcetype instead of just them being combined into one column with a "::" in the middle? (Exact same format as my example output)
add
| rex field=hosts "(?<host>.*?)::(?<sourcetype>.*)"
| fields - hosts
| table host sourcetype *
EDIT: Worked perfectly! Thanks @to4kawa !!!!